General

  • Target

    bdd159fbba0032b295fc4cd9b7242cd79be8c07378cf5f46df6e4b69c2cc060c

  • Size

    289KB

  • Sample

    221030-g4vlmsfdg4

  • MD5

    a29799b9cb380736ced59949ab913e10

  • SHA1

    29043cf8484ec6b3df7a5ddfb465446a8dc311a9

  • SHA256

    bdd159fbba0032b295fc4cd9b7242cd79be8c07378cf5f46df6e4b69c2cc060c

  • SHA512

    875b87b158c65d58cf0a1e7a39594e0b7214baf799cd5cac1633cc49e50e499961e0f679d3b590f3d97886795d1517ec350badd7f3b4392e6de73ffa71717298

  • SSDEEP

    6144:GOpslFlqehdBCkWYxuukP1pjSKSNVkq/MVJbj:GwslXTBd47GLRMTbj

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Buy

C2

peruxd.no-ip.biz:81

Mutex

E3H70604F27QN2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      bdd159fbba0032b295fc4cd9b7242cd79be8c07378cf5f46df6e4b69c2cc060c

    • Size

      289KB

    • MD5

      a29799b9cb380736ced59949ab913e10

    • SHA1

      29043cf8484ec6b3df7a5ddfb465446a8dc311a9

    • SHA256

      bdd159fbba0032b295fc4cd9b7242cd79be8c07378cf5f46df6e4b69c2cc060c

    • SHA512

      875b87b158c65d58cf0a1e7a39594e0b7214baf799cd5cac1633cc49e50e499961e0f679d3b590f3d97886795d1517ec350badd7f3b4392e6de73ffa71717298

    • SSDEEP

      6144:GOpslFlqehdBCkWYxuukP1pjSKSNVkq/MVJbj:GwslXTBd47GLRMTbj

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks